Method, device and equipment for switching VLAN (Virtual Local Area Network) isolation level based on terminal behavior and storage medium

Abstract

The invention discloses a method, device and equipment for switching VLAN isolation levels based on terminal behaviors and a storage medium, and relates to the technical field of communication, and the method comprises the steps: obtaining traffic data when a new terminal accesses a network; redirecting the flow data to a network bridge of a common isolation level according to a preset VLAN distribution strategy; collecting traffic characteristics of the terminal in real time based on a hook program deployed in a kernel network protocol stack; judging whether an abnormal behavior is met or not according to the traffic feature and a traffic feature threshold value; and if the abnormal behavior is satisfied, modifying a flow control rule, and switching the flow data of the terminal from the network bridge of the common isolation level to a network bridge of a high isolation level. According to the method, the accuracy of switching the isolation level of the VLAN can be improved.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method, apparatus, device, and storage medium for switching VLAN isolation levels based on terminal behavior. Background Technology

[0002] With the widespread adoption of mobile internet and smart terminals, open Wi-Fi networks have become widely used in public spaces such as shopping malls, airports, and office buildings, serving as one of the primary methods for terminals to access the network. While the openness of these networks provides users with a convenient access experience, it also brings characteristics such as diverse terminal devices and high mobility of access. Access devices include personal mobile phones and laptops, and may also include unauthorized IoT devices. Furthermore, the location and online duration of terminal access are unpredictable, posing a serious challenge to network security management. How to ensure normal user access while preventing malicious terminals from attacking and interfering with the network has become a requirement for the management of open Wi-Fi networks.

[0003] To address the security risks of open Wi-Fi networks, existing technologies typically employ static VLAN (Virtual Local Area Network) isolation schemes. This involves assigning a fixed VLAN to a terminal based on its initial access information (such as access location and device type), achieving isolation between terminals by dividing them into different broadcast domains. Some solutions optimize this by using a random VLAN allocation strategy, randomly assigning newly accessed terminals to multiple pre-defined VLANs. This reduces the risk of congestion caused by too many terminals in a single VLAN and minimizes the impact of a single malicious terminal on the entire network. Simultaneously, existing solutions perform basic security checks (such as device authentication) upon initial terminal access, only allowing access to the corresponding VLAN after successful authentication.

[0004] However, existing technical solutions have low accuracy when switching VLAN isolation levels based on terminal behavior. Summary of the Invention

[0005] This application provides a method, apparatus, device, and storage medium for switching VLAN isolation levels based on terminal behavior, which can improve the accuracy of switching VLAN isolation levels.

[0006] To achieve the above objectives, this application adopts the following technical solution: Firstly, this application provides a method for switching VLAN isolation levels based on terminal behavior, including: Acquire traffic data when a new terminal accesses the network; According to the preset VLAN allocation policy, the traffic data is redirected to a bridge with a normal isolation level; Based on hook programs deployed in the kernel network protocol stack, the traffic characteristics of the terminal are collected in real time. Based on the traffic characteristics and traffic characteristic thresholds, determine whether abnormal behavior is met; If the abnormal behavior is detected, the traffic control rules are modified to switch the terminal's traffic data from the bridge with the normal isolation level to the bridge with the high isolation level.

[0007] Optionally, the traffic characteristics include TCP connection establishment rate and destination IP address entropy value, and the traffic characteristic thresholds include rate threshold and entropy value threshold. The step of determining whether abnormal behavior is satisfied based on the traffic characteristics and traffic characteristic thresholds includes: When the TCP connection establishment rate exceeds the rate threshold or the destination IP address entropy value exceeds the entropy value threshold, the abnormal behavior is determined to be met.

[0008] Optionally, the method further includes: After switching the terminal's traffic data from the ordinary isolation level bridge to the high isolation level bridge, a gratuitous ARP message is sent to the terminal to trigger the access switch to update the MAC address forwarding table entries.

[0009] Optionally, the method further includes: After the traffic data of the terminal is switched to the high-isolation bridge, the traffic characteristics of the terminal continue to be monitored; If the terminal recovers from abnormal behavior to normal behavior, the traffic control rules are modified again to redirect traffic data back to the bridge at the normal isolation level.

[0010] Optionally, the terminal recovering from abnormal behavior to normal behavior includes: When the TCP connection establishment rate in the traffic characteristics is consistently lower than or equal to the rate threshold and the destination IP address entropy value in the traffic characteristics is consistently lower than or equal to the entropy value threshold, it is determined that the terminal has recovered from abnormal behavior to normal behavior.

[0011] Optionally, sending a gratuitous ARP message to the new terminal includes: Generate a gratuitous ARP packet containing the terminal's MAC address and the corresponding port IP address of the high-isolation-level bridge, and send the ARP packet to the terminal.

[0012] Optionally, the preset VLAN allocation strategy includes a random allocation strategy, a round-robin allocation strategy, or a load-based allocation strategy; The load-based allocation strategy includes: Real-time statistics on the current number of terminal connections for each sub-node under the ordinary isolation level bridge; Based on the current number of terminal connections, the traffic data of the new terminal is redirected to the ordinary isolation level bridge corresponding to the child node with the fewest connections.

[0013] Secondly, this application provides a device for switching VLAN isolation levels based on terminal behavior, comprising: The acquisition module is used to acquire traffic data when a new terminal accesses the network; The judgment module is used to redirect the traffic data to a bridge with a normal isolation level according to a preset VLAN allocation policy; to collect the traffic characteristics of the terminal in real time based on a hook program deployed in the kernel network protocol stack; and to determine whether abnormal behavior is met based on the traffic characteristics and traffic characteristic thresholds. The processing module is used to modify the traffic control rules if abnormal behavior is met, and switch the traffic data of the terminal from the bridge with the normal isolation level to the bridge with the high isolation level.

[0014] Thirdly, this application provides a computing device, including a memory and a processor; The memory stores one or more computer programs, the one or more computer programs including instructions; when the instructions are executed by the processor, the computing device performs the method as described in any one of the first aspects.

[0015] Fourthly, this application provides a computer-readable storage medium for storing a computer program for performing the method as described in any one of the first aspects.

[0016] As can be seen from the above technical solution, this application has at least the following beneficial effects: First, existing solutions rely solely on initial terminal access information to assign fixed or random VLANs, failing to adjust protection strategies based on real-time terminal behavior after access, which can easily lead to malicious terminals continuously threatening network security. This method, however, uses hook programs in the kernel network protocol stack to collect terminal traffic characteristics (TCP connection establishment rate, destination IP address entropy) in real time, and judges abnormal behavior based on preset thresholds. When the TCP connection establishment rate exceeds the threshold (e.g., frequent connection initiation in a short period, possibly indicating a scanning attack) or the destination IP address entropy exceeds the threshold (e.g., connecting to a large number of scattered IPs, possibly indicating malicious communication), the terminal traffic is immediately switched from a normal isolation level bridge to a high isolation level bridge. This prevents malicious terminals from interfering with the core network area or other normal terminals, overcoming the shortcomings of existing static isolation solutions that cannot cope with dynamic terminal behavior.

[0017] Secondly, existing solutions often lack flexible recovery mechanisms after a terminal is deemed risky, potentially leading to normal terminals being permanently restricted from network use due to brief abnormal behavior, impacting user experience. This method, however, continues to monitor the traffic characteristics of a terminal after it switches to a high isolation level. When the TCP connection establishment rate and destination IP address entropy value remain consistently below thresholds, indicating that the terminal has returned to normal behavior, traffic can be redirected back to a bridge at the normal isolation level. This ensures network security (timely isolation in case of anomalies) while avoiding excessive restrictions on normal terminals, meeting the need for both convenient access and secure protection in open Wi-Fi networks.

[0018] Thirdly, on the one hand, this method provides multiple VLAN allocation strategies, such as random allocation, round-robin allocation, and load-based allocation (directing new terminals to the sub-node bridge with the fewest connections). It can dynamically adjust the ordinary isolation level bridge accessed by the terminal according to the network load, reducing the risk of congestion on a single bridge and solving the problem that existing random allocation strategies do not consider load balancing. On the other hand, when switching isolation levels, a gratuitous ARP packet containing the terminal's MAC address and the IP of the high-isolation level bridge port is sent, which can trigger the access switch to update the MAC address forwarding table entries in a timely manner, ensuring that network communication is not interrupted after the terminal traffic switches. This method adapts to the characteristics of open Wi-Fi networks where the terminal access location and online duration are not fixed, thus improving the stability of network operation.

[0019] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0020] Figure 1 A flowchart illustrating a method for switching VLAN isolation levels based on terminal behavior, provided in an embodiment of this application; Figure 2 A schematic diagram of a device for switching VLAN isolation levels based on terminal behavior, provided in an embodiment of this application; Figure 3 This is a schematic diagram of a computing device provided in an embodiment of this application. Detailed Implementation

[0021] The terms "first," "second," and "third," etc., used in this application specification and accompanying drawings are used to distinguish different objects, not to limit a specific order.

[0022] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0023] To ensure clarity and conciseness in the description of the following embodiments, a brief introduction to the related technologies is given first: Static VLAN (Virtual Local Area Network) isolation is a traditional network security isolation technology. By pre-setting rules (such as terminal access location and device type), it assigns fixed VLAN segments to access terminals, divides the network into multiple independent broadcast domains, realizes communication isolation of terminals in different VLANs, and avoids the impact of a single terminal malfunction on the entire network.

[0024] In the management of open Wi-Fi networks in public settings such as shopping malls, airports, and office buildings, existing technical solutions face major technical challenges: they cannot accurately switch VLAN isolation levels based on the dynamic behavior of connected terminals, making it difficult to balance security protection and user experience; after abnormal terminals (such as devices launching attacks) pass the initial security check, static VLAN isolation cannot upgrade the protection level in a timely manner, continuously threatening network security; when normal terminals experience temporary anomalies due to temporary network fluctuations, there is a lack of flexible recovery mechanisms, making them prone to long-term usage restrictions; in addition, there are problems such as some VLAN congestion and traffic interruption after isolation switching, making it difficult to adapt to the diverse and highly mobile characteristics of open Wi-Fi network terminals.

[0025] The main reasons for the above problems lie in the design flaws of the existing solutions: First, the isolation strategy relies on the initial access information of the terminal (such as location and device type) and does not monitor the real-time behavior of the terminal after access (such as TCP connection frequency and communication objects), so static protection cannot cope with the dynamic behavior changes of the terminal; Second, the anomaly judgment relies solely on the initial authentication and lacks multi-dimensional judgment criteria based on traffic characteristics, making it impossible to accurately identify malicious behavior; Third, VLAN allocation does not consider load balancing, which can easily cause congestion, and the switch MAC address forwarding table is not updated synchronously when switching isolation levels, resulting in unstable traffic forwarding and further exacerbating the contradiction between security protection efficiency and network operation experience.

[0026] In view of this, embodiments of this application provide a method for switching VLAN isolation levels based on terminal behavior, which can be executed by a processing device. The processing device can be a terminal or a server. Terminals include, but are not limited to, smartphones, tablets, laptops, personal digital assistants, or smart wearable devices. The server can be a cloud server, such as a central server in a central cloud computing cluster or an edge server in an edge cloud computing cluster. Alternatively, the server can be a server in a local data center. A local data center refers to a data center directly controlled by the user.

[0027] To address the challenges of diverse and mobile terminals in open Wi-Fi networks, and the inability of existing solutions to accurately switch VLAN isolation levels based on dynamic terminal behavior, this application uses real-time traffic characteristics after terminal access as the primary criterion. It captures key traffic indicators (TCP connection establishment rate, destination IP address entropy) through kernel-level hook programs and combines these with preset thresholds to accurately identify abnormal behavior. A two-tiered isolation bridge (normal and high-level) is designed to dynamically adjust the isolation level, automatically upgrading to higher levels during anomalies and reverting to normal operation after recovery. Simultaneously, the VLAN allocation strategy (supporting load balancing, etc.) and switching mechanism (ensuring stable communication through gratuitous ARP packets) are optimized. This approach not only solves the security vulnerabilities of static isolation in existing solutions but also considers user experience and network efficiency, constructing a dynamic security protection system adapted to open Wi-Fi network scenarios.

[0028] To make the technical solution of this application clearer and easier to understand, the following describes a method for switching VLAN isolation levels based on terminal behavior, provided by an embodiment of this application, in conjunction with the accompanying drawings. Figure 1 As shown, this figure is a flowchart of a method for switching VLAN isolation levels based on terminal behavior according to an embodiment of this application. The method includes: S201, The processing device acquires traffic data when a new terminal accesses the network.

[0029] The new terminal is a terminal device that is accessing the currently open Wi-Fi network for the first time, including personal mobile phones, laptops, IoT devices (such as smart cameras and sensors), etc., and its access behavior is the starting condition for triggering the subsequent processes of this method.

[0030] Accessing a network refers to the process by which a terminal device successfully connects to an open Wi-Fi network by searching for Wi-Fi signals and completing authentication operations (such as password input or SMS verification), marking the beginning of data interaction between the terminal and the network.

[0031] Traffic data is a collection of various data packets generated after a terminal accesses the network. It contains information about the interaction between the terminal and the network, such as the source address, destination address, transmission protocol (e.g., TCP / UDP), connection request frequency, and data transmission volume. It is the basic data source for analyzing terminal behavior.

[0032] When a new terminal successfully accesses the open Wi-Fi network through access verification, the processing device deployed at key network nodes (such as gateways) will automatically trigger a data collection mechanism to capture the traffic data generated by the terminal during the initial access phase through the network interface. This data includes connection requests initiated by the terminal and interaction messages with network devices. After acquiring the data, the processing device will perform preliminary formatting and storage to ensure that the data is complete and usable, laying the foundation for subsequent steps.

[0033] The purpose of this step is to achieve real-time perception of new terminal access behavior, breaking through the limitations of traditional solutions that rely solely on initial access information (such as access location). By capturing traffic data, it provides data support for subsequent dynamic isolation strategies, which is in line with the characteristics of open Wi-Fi network terminals, which are diverse and highly mobile.

[0034] S202. The processing device redirects traffic data to a bridge with a normal isolation level according to the preset VLAN allocation policy.

[0035] The preset VLAN allocation strategy is a set of rules pre-configured in the processing device to determine the affiliation of new terminal traffic. The preset VLAN allocation strategy includes random allocation strategy, round-robin allocation strategy, or load-based allocation strategy. The random allocation strategy randomly directs new terminal traffic to multiple ordinary isolation level bridges. The round-robin allocation strategy sequentially and cyclically allocates traffic data to different ordinary isolation level bridges. The load-based allocation strategy counts the number of terminal connections on each ordinary isolation level bridge sub-node in real time and directs traffic to the sub-node with the fewest connections.

[0036] Traffic redirection is an operation in which a processing device modifies network forwarding rules, such as adjusting the routing table or configuring traffic control policies, to redirect the traffic data of a new terminal from the default transmission path to a specified target (in this case, a normal isolation level bridge). This ensures that terminal data is transmitted only within a preset isolation range and avoids cross-isolation domain communication.

[0037] The ordinary isolation level bridge is the network device used in this application to carry normal terminal traffic. It has basic network segment isolation capabilities and can divide the accessed terminals into independent broadcast domains to prevent broadcast storm interference between ordinary terminals. However, it does not restrict the necessary communication between the terminal and the network core service or other normal terminals, balancing isolation security and user convenience. It is the default bridge for new terminals after they are connected.

[0038] First, the processing device retrieves the pre-configured VLAN allocation policy. For example, it selects a load-based allocation policy based on the current network load. If a load-based policy is selected, it first counts the current number of terminal connections of each sub-node under the ordinary isolation level bridge in real time. Based on the current number of terminal connections, it redirects the traffic data of the new terminal to the ordinary isolation level bridge corresponding to the sub-node with the fewest connections. Next, the processing device generates traffic forwarding rules according to the selected strategy, and redirects the previously acquired new terminal traffic data from the default transmission path to the target ordinary isolation level bridge by adjusting network routing or traffic control parameters; Ultimately, all subsequent network interaction data of the new terminal (such as web page access and data transmission) are transmitted through this ordinary isolation level bridge. This achieves basic isolation between the new terminal and other network segments, avoiding the impact on the network area upon initial access, while also ensuring the communication needs of normal terminals. This aligns with the security management logic of open Wi-Fi networks, which prioritizes basic isolation and then dynamically adjusts the network.

[0039] S203, the processing device uses hook programs deployed in the kernel network protocol stack to collect the traffic characteristics of the terminal in real time.

[0040] The kernel network protocol stack is a module in the operating system kernel responsible for handling network data transmission. It covers the implementation of network protocols such as TCP / IP, and undertakes tasks such as encapsulation, forwarding, and parsing of data between the terminal and the network. It is the underlying channel for network data interaction and directly determines the efficiency and stability of data transmission.

[0041] Hook programs are lightweight program modules embedded in the kernel network protocol stack. They can actively capture data at key nodes of the network data flow through the protocol stack (such as the data reception and connection establishment phases) without relying on external devices or additional data forwarding. They have the characteristics of low latency and high real-time performance and are the technical carrier for real-time acquisition of traffic information in this application.

[0042] Traffic characteristics are indicators extracted from terminal traffic data that reflect the terminal's network behavior patterns. In this application, traffic characteristics include TCP connection establishment rate and destination IP address entropy value. TCP connection establishment rate is the number of TCP connections initiated by the terminal per unit time, which can identify abnormal behaviors such as high-frequency scanning. Destination IP address entropy value is the degree of dispersion of destination IP addresses connected by the terminal, which can identify malicious dispersion of communication behavior. Traffic characteristics are the basis for judging whether the terminal behavior is normal.

[0043] First, the processing device pre-deploys a hook program in the network protocol stack of the system kernel. This program continuously monitors the terminal traffic data flowing through the protocol stack. When the terminal performs network interaction (such as accessing web pages or initiating data connections) within a normal isolation level bridge, the traffic data will naturally flow through the kernel network protocol stack. At this time, the hook program will automatically capture data at key nodes in data transmission (such as when a TCP connection request is initiated or when a data packet is received). Next, the hook program extracts traffic characteristics that reflect terminal behavior from the captured traffic data in real time. For example, it counts the number of TCP connections initiated by the terminal per unit time and calculates the TCP connection establishment rate; it analyzes the distribution of all destination IP addresses connected by the terminal and calculates the destination IP address entropy value. Finally, the hook program transmits the extracted traffic features to the data analysis module of the processing device in real time, ensuring that the processing device can obtain the current behavior data of the terminal in a timely manner, laying the foundation for subsequent comparison with thresholds to determine anomalies.

[0044] S204. The processing equipment determines whether abnormal behavior is met based on the flow characteristics and the flow characteristic threshold.

[0045] Traffic characteristic thresholds include rate thresholds and entropy thresholds. When the TCP connection establishment rate is greater than the rate threshold or the destination IP address entropy value is greater than the entropy threshold, it is determined that abnormal behavior is met.

[0046] The rate threshold is a pre-set critical value used to determine whether the TCP connection establishment rate is abnormal, for example, a rate threshold set to 10 times / second. This rate threshold needs to be determined comprehensively by combining the normal usage scenarios of open Wi-Fi networks (such as the TCP connection establishment rate of about 2-5 times / second when ordinary users browse the web) and the characteristics of common attack behaviors (such as the rate often exceeding 20 times / second during port scanning attacks). It is the standard for distinguishing between normal connection requests and high-frequency abnormal requests.

[0047] The entropy threshold is a pre-set critical value used to determine whether the entropy value of a destination IP address is abnormal. The value ranges from 0 to 8. The higher the entropy value, the more dispersed the destination IP addresses connected by the terminal. For example, if the entropy threshold is set to 5, when the entropy value exceeds this value, it indicates that the terminal has connected to a large number of different IP addresses in a short period of time, which may indicate malicious communication (such as sending attack packets to multiple nodes). It serves as the basis for distinguishing between centralized normal communication and dispersed abnormal communication.

[0048] First, the processing device pre-stores two types of traffic characteristic thresholds: rate threshold (e.g., 10 times / second) and entropy threshold (e.g., 5). Both types of thresholds are derived from the normal business data of open Wi-Fi networks and the statistics of historical attack cases to ensure that the judgment criteria are in line with the actual scenario. Next, the processing device compares the real-time collected terminal traffic characteristics (TCP connection establishment rate, destination IP address entropy value) with the corresponding thresholds: if the terminal TCP connection establishment rate exceeds the rate threshold (e.g., reaching 15 times / second), it indicates that it initiates connections at high frequency in a short period of time, which may be due to port scanning, brute-force attacks, or other attacks; if the destination IP address entropy value exceeds the entropy value threshold (e.g., reaching 6), it indicates that the IP addresses it connects to are highly dispersed, which may be due to malicious diffusion attacks, data theft, or other abnormal behaviors. Finally, since both types of abnormal behavior can pose a threat to network security, the judgment logic adopts an "or" relationship. As long as either condition is met, the terminal is judged to have abnormal behavior, thus avoiding security risks caused by missing a single indicator. For example, even if a malicious terminal has a normal TCP connection rate, it can still be accurately identified if its entropy value is abnormal.

[0049] S205. If the abnormal behavior is met, the processing device modifies the flow control rules to switch the terminal's traffic data from the ordinary isolation level bridge to the high isolation level bridge.

[0050] Modifying traffic control rules is an operation that processes devices to adjust the preset traffic forwarding logic within the network (such as updating the routing table, configuring access control lists (ACLs), and adjusting bridge forwarding policies). The purpose is to change the transmission path of terminal traffic, directing it from the original ordinary isolation level bridge to a new target bridge. It is a technical means to achieve isolation level switching.

[0051] The high-isolation-level bridge is a dedicated network device used in this application to carry abnormal terminal traffic. Compared with ordinary isolation-level bridges, it has stronger isolation and restriction capabilities. It not only divides independent broadcast domains, but also restricts communication between the terminal and the core network area (such as server clusters and management nodes) and other ordinary isolation-level bridge terminals. It only allows the terminal to perform necessary basic network interactions (such as obtaining isolation prompt information), which can effectively block abnormal terminal attacks and interference to the network.

[0052] When the processing device determines that the terminal has abnormal behavior by comparing traffic characteristics with thresholds, it will immediately trigger the traffic path adjustment mechanism. First, it will modify the traffic control rules stored in its own storage, such as updating the forwarding entry corresponding to the MAC address of the terminal in the routing table, or adjusting the traffic allowance policy of the terminal in the ACL rules, and explicitly changing the target bridge of all its subsequent traffic from the ordinary isolation level bridge to the high isolation level bridge. After the rules are modified, subsequent network traffic generated by the terminal (such as continued TCP connections and data transmission requests) will be automatically diverted to the high-isolation-level bridge according to the new flow control rules, and will no longer enter the original ordinary isolation-level bridge. The high-isolation-level bridge will block the abnormal terminal's access to core network resources through strict communication restrictions, and at the same time prevent it from spreading attack behaviors to other normal terminals (such as sending malicious data packets), cutting off the threat propagation channel of the abnormal terminal from the physical transmission path.

[0053] After switching the terminal's traffic data from a bridge with a normal isolation level to a bridge with a high isolation level, a gratuitous ARP packet is sent to the terminal to trigger the access switch to update the MAC address forwarding table entries.

[0054] A gratuitous ARP message is a special type of ARP (Address Resolution Protocol) message that is sent proactively by the device without requiring a prior request from the receiver. It contains the MAC address of the target terminal and the port IP address of the newly accessed network segment (in this case, a high-isolation bridge). Its purpose is to announce to switches, terminals, and other devices in the network that the IP address corresponding to a certain MAC address has been updated, and address mapping synchronization can be completed without waiting for an ARP request.

[0055] Specifically, the processing device generates a gratuitous ARP packet containing the terminal's MAC address and the corresponding port IP address of the high-isolation-level bridge, and sends the ARP packet to the terminal.

[0056] After the processing device completes the path adjustment of terminal traffic from the ordinary isolation level bridge to the high isolation level bridge, the MAC address of the terminal in the original MAC address forwarding table of the access switch still corresponds to the port IP of the ordinary isolation level bridge. If it is not updated in time, the switch will still forward the terminal's subsequent traffic to the original ordinary isolation level bridge, resulting in traffic loss and terminal network outage. Therefore, the processing device will immediately generate and send a gratuitous ARP message to the terminal. The message will clearly carry the terminal's own MAC address and the IP address of the port corresponding to the high isolation level bridge. This is equivalent to actively informing the access switch that the terminal with the MAC address has switched to the high isolation level bridge corresponding to the new IP. When the access switch receives a gratuitous ARP packet, it will automatically trigger an update operation of the MAC address forwarding table entries, deleting the original mapping between the terminal MAC address and the IP address of the ordinary bridge port, and adding a mapping between the terminal MAC address and the IP address of the high-isolation bridge port. After the update is completed, when the switch receives traffic from this terminal, it can accurately forward it to the high-isolation bridge, ensuring that the terminal can still perform necessary network interactions (such as receiving isolation prompt information) normally after the isolation level is switched, and avoiding communication interruption caused by table lag.

[0057] The method also includes: After the terminal's traffic data is switched to a bridge with a high isolation level, the terminal's traffic characteristics continue to be monitored. If the terminal recovers from abnormal behavior to normal behavior, the traffic control rules are modified again to redirect the traffic data back to the bridge with the normal isolation level.

[0058] When the TCP connection establishment rate in the traffic characteristics is consistently lower than or equal to the rate threshold and the destination IP address entropy value in the traffic characteristics is consistently lower than or equal to the entropy value threshold, it is determined that the terminal has recovered from abnormal behavior to normal behavior.

[0059] The specific logic is as follows: First, after the terminal traffic is switched to the high isolation level bridge, the processing device will not stop monitoring. Instead, it will continuously collect the TCP connection establishment rate and destination IP address entropy value of the terminal through the kernel hook program, and track the changes in terminal behavior in real time. This step avoids the problem of permanent restriction after isolation and provides a recovery opportunity for normal terminals due to temporary fluctuations (such as the entropy value increasing due to connecting multiple apps in a short period of time). Next, the processing equipment determines whether the terminal has recovered to normal based on the standard of continuous compliance with two indicators: the TCP connection establishment rate must be ≤ the rate threshold for multiple consecutive monitoring periods (e.g., ≤ 10 times / second for 15 seconds, indicating no high-frequency connection behavior) and the destination IP address entropy value must be ≤ the entropy value threshold for multiple consecutive monitoring periods (e.g., ≤ 5 for 15 seconds, indicating that the communication objects are concentrated and there is no scattered malicious interaction). If only a single indicator meets the standard or only meets the standard once, it will not be judged as a recovery, to ensure the accuracy of the results. Finally, if the terminal is determined to have returned to normal, the processing device will modify the traffic control rules again, such as updating the routing table and adjusting the ACL policy, to redirect the terminal traffic from the high isolation level bridge back to the ordinary isolation level bridge, allowing the terminal to regain normal network access permissions. This ensures network security (timely isolation in case of anomalies) and also takes into account user experience (flexible recovery after normalization), forming a complete dynamic protection closed loop of monitoring, isolation, and recovery.

[0060] Based on the above description, this application has the following beneficial effects: First, existing solutions rely solely on initial terminal access information to assign fixed or random VLANs, failing to adjust protection strategies based on real-time terminal behavior after access, which can easily lead to malicious terminals continuously threatening network security. This method, however, uses hook programs in the kernel network protocol stack to collect terminal traffic characteristics (TCP connection establishment rate, destination IP address entropy) in real time, and judges abnormal behavior based on preset thresholds. When the TCP connection establishment rate exceeds the threshold (e.g., frequent connection initiation in a short period, possibly indicating a scanning attack) or the destination IP address entropy exceeds the threshold (e.g., connecting to a large number of scattered IPs, possibly indicating malicious communication), the terminal traffic is immediately switched from a normal isolation level bridge to a high isolation level bridge. This prevents malicious terminals from interfering with the core network area or other normal terminals, overcoming the shortcomings of existing static isolation solutions that cannot cope with dynamic terminal behavior.

[0061] Secondly, existing solutions often lack flexible recovery mechanisms after a terminal is deemed risky, potentially leading to normal terminals being permanently restricted from network use due to brief abnormal behavior, impacting user experience. This method, however, continues to monitor the traffic characteristics of a terminal after it switches to a high isolation level. When the TCP connection establishment rate and destination IP address entropy value remain consistently below thresholds, indicating that the terminal has returned to normal behavior, traffic can be redirected back to a bridge at the normal isolation level. This ensures network security (timely isolation in case of anomalies) while avoiding excessive restrictions on normal terminals, meeting the need for both convenient access and secure protection in open Wi-Fi networks.

[0062] Thirdly, on the one hand, this method provides multiple VLAN allocation strategies, such as random allocation, round-robin allocation, and load-based allocation (directing new terminals to the sub-node bridge with the fewest connections). It can dynamically adjust the ordinary isolation level bridge accessed by the terminal according to the network load, reducing the risk of congestion on a single bridge and solving the problem that existing random allocation strategies do not consider load balancing. On the other hand, when switching isolation levels, a gratuitous ARP packet containing the terminal's MAC address and the IP of the high-isolation level bridge port is sent, which can trigger the access switch to update the MAC address forwarding table entries in a timely manner, ensuring that network communication is not interrupted after the terminal traffic switches. This method adapts to the characteristics of open Wi-Fi networks where the terminal access location and online duration are not fixed, thus improving the stability of network operation.

[0063] The above text combined Figure 1 The method for switching VLAN isolation levels based on terminal behavior provided in the embodiments of this application has been described in detail. The apparatus and devices provided in the embodiments of this application will be described below with reference to the accompanying drawings.

[0064] like Figure 2 As shown in the figure, this is a schematic diagram of a device for switching VLAN isolation levels based on terminal behavior according to an embodiment of this application. The device includes: The acquisition module 301 is used to acquire traffic data when a new terminal accesses the network. The judgment module 302 is used to redirect the traffic data to a bridge with a normal isolation level according to a preset VLAN allocation policy; collect the traffic characteristics of the terminal in real time based on a hook program deployed in the kernel network protocol stack; and determine whether abnormal behavior is met based on the traffic characteristics and traffic characteristic thresholds. The processing module 303 is used to modify the flow control rules if abnormal behavior is met, and switch the flow data of the terminal from the ordinary isolation level bridge to the high isolation level bridge.

[0065] Optionally, the judgment module 302 is specifically used to determine whether abnormal behavior is met when the TCP connection establishment rate is greater than the rate threshold or the destination IP address entropy value is greater than the entropy value threshold.

[0066] Optionally, the processing module 303 is further configured to send a gratuitous ARP message to the terminal after switching the terminal's traffic data from the ordinary isolation level bridge to the high isolation level bridge, so as to trigger the access switch to update the MAC address forwarding table entries.

[0067] Optionally, the processing module 303 is also configured to continue monitoring the traffic characteristics of the terminal after the terminal's traffic data is switched to the high-isolation bridge; If the terminal recovers from abnormal behavior to normal behavior, the traffic control rules are modified again to redirect traffic data back to the bridge at the normal isolation level.

[0068] Optionally, the judgment module 302 is specifically used to determine that the terminal has recovered from abnormal behavior to normal behavior when the TCP connection establishment rate in the traffic characteristics is continuously lower than or equal to the rate threshold and the destination IP address entropy value in the traffic characteristics is continuously lower than or equal to the entropy value threshold.

[0069] Optionally, the processing module 303 is specifically used to generate a gratuitous ARP packet containing the terminal's MAC address and the corresponding port IP address of the high-isolation-level bridge, and send the ARP packet to the terminal.

[0070] Optionally, the processing module 303 is also used to count the current number of terminal connections of each sub-node under the ordinary isolation level bridge in real time; and to redirect the traffic data of the new terminal to the ordinary isolation level bridge corresponding to the sub-node with the fewest connections based on the current number of terminal connections.

[0071] The apparatus for switching VLAN isolation levels based on terminal behavior according to the embodiments of this application can correspond to executing the method described in the embodiments of this application, and the other operations and / or functions of each module / unit of the apparatus for switching VLAN isolation levels based on terminal behavior are respectively for implementing Figure 1 For the sake of brevity, the corresponding processes of each method in the illustrated embodiments will not be described in detail here.

[0072] This application also provides a computing device. For example... Figure 3 As shown in the figure, this is a schematic diagram of a computing device provided in an embodiment of this application. The computing device 700 includes a bus 701, a processor 702, a communication interface 703, and a memory 704. The processor 702, the memory 704, and the communication interface 703 communicate with each other via the bus 701.

[0073] The 701 bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 3 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0074] The processor 702 can be any one or more of the following processors: central processing unit (CPU), graphics processing unit (GPU), microprocessor (MP), or digital signal processor (DSP).

[0075] The communication interface 703 is used for external communication.

[0076] Memory 704 may include volatile memory, such as random access memory (RAM). Memory 704 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0077] The memory 704 stores executable code, and the processor 702 executes the executable code to perform the aforementioned method for switching VLAN isolation levels based on terminal behavior.

[0078] Specifically, in achieving Figure 2 In the case of the illustrated embodiment, and Figure 2 When the modules or units of the device for switching VLAN isolation levels based on terminal behavior described in the embodiments are implemented in software, the execution... Figure 2 The software or program code required for the functions of each module / unit can be partially or entirely stored in the memory 704. The processor 702 executes the program code corresponding to each unit stored in the memory 704, and executes the aforementioned method for switching VLAN isolation levels based on terminal behavior.

[0079] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-described method for switching VLAN isolation levels based on terminal behavior.

[0080] This application also provides a computer program product comprising one or more computer instructions. When the computer instructions are loaded and executed on a computing device, all or part of the processes or functions described in this application are generated.

[0081] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, or data center to another website, computer, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0082] When the computer program product is executed by a computer, the computer executes any of the aforementioned methods for switching VLAN isolation levels based on terminal behavior. The computer program product can be a software installation package; when any of the aforementioned methods for switching VLAN isolation levels based on terminal behavior is required, the computer program product can be downloaded and executed on the computer.

[0083] The descriptions of the processes or structures corresponding to the above figures each have their own emphasis. For parts of a process or structure that are not described in detail, please refer to the relevant descriptions of other processes or structures.

[0084] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application.

Claims

1. A method for switching a VLAN isolation level based on terminal behavior, characterized in that, The method comprises: acquiring traffic data when a new terminal accesses a network; redirection of the traffic data to a bridge of a normal isolation level according to a preset VLAN allocation strategy; real-time collection of traffic characteristics of the terminal based on a hook program deployed in a kernel network protocol stack; determination of whether abnormal behavior is met according to the traffic characteristics and a traffic characteristic threshold value; if the abnormal behavior is met, modification of a traffic control rule to switch the traffic data of the terminal from the bridge of the normal isolation level to a bridge of a high isolation level.

2. The method of claim 1, wherein, The traffic characteristics comprise a TCP connection establishment rate and a destination IP address entropy value, the traffic characteristic threshold value comprises a rate threshold value and an entropy value threshold value, and the determination of whether abnormal behavior is met according to the traffic characteristics and the traffic characteristic threshold value comprises: determination of the abnormal behavior being met when the TCP connection establishment rate is greater than the rate threshold value or the destination IP address entropy value is greater than the entropy value threshold value.

3. The method of claim 1, wherein, The method further comprises: sending a gratuitous ARP packet to the terminal to trigger an access switch to update a MAC address forwarding table item after the traffic data of the terminal is switched from the bridge of the normal isolation level to the bridge of the high isolation level.

4. The method of claim 2, wherein, The method further comprises: continuing to monitor the traffic characteristics of the terminal after the traffic data of the terminal is switched to the bridge of the high isolation level; if the terminal returns to normal behavior from abnormal behavior, modifying the traffic control rule again to redirect the traffic data back to the bridge of the normal isolation level.

5. The method of claim 4, wherein, The terminal returning to normal behavior from abnormal behavior comprises: determination that the terminal has returned to normal behavior from abnormal behavior when the TCP connection establishment rate in the traffic characteristics continuously is lower than or equal to the rate threshold value and the destination IP address entropy value in the traffic characteristics continuously is lower than or equal to the entropy value threshold value.

6. The method of claim 3, wherein, The sending of the gratuitous ARP packet to the terminal comprises: generating a gratuitous ARP packet containing the MAC address of the terminal and an IP address of a corresponding port of the bridge of the high isolation level and sending the ARP packet to the terminal.

7. The method of claim 1, wherein, The preset VLAN allocation strategy comprises a random allocation strategy, a polling allocation strategy or a load-based allocation strategy; the load-based allocation strategy comprises: real-time statistics of a current terminal connection quantity of each sub-node under the bridge of the normal isolation level; redirection of the traffic data of the new terminal to the bridge of the normal isolation level corresponding to a sub-node with the least connection quantity according to the current terminal connection quantity.

8. An apparatus for switching a VLAN isolation level based on terminal behavior, the apparatus comprising: a terminal behavior detection module configured to detect a terminal behavior; and a VLAN isolation level switching module configured to switch a VLAN isolation level based on the terminal behavior. The apparatus comprises: an acquisition module configured to acquire traffic data when a new terminal accesses a network; a determination module configured to redirect the traffic data to a bridge of a normal isolation level according to a preset VLAN allocation strategy, collect traffic characteristics of the terminal in real time based on a hook program deployed in a kernel network protocol stack and determine whether abnormal behavior is met according to the traffic characteristics and a traffic characteristic threshold value; a processing module configured to modify a traffic control rule to switch the traffic data of the terminal from the bridge of the normal isolation level to a bridge of a high isolation level if the abnormal behavior is met.

9. A computing device, comprising: comprises a memory and a processor; wherein the memory has stored thereon one or more computer programs comprising instructions, which, when executed by the processor, cause the computing device to perform the method of any of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer readable storage medium is for storing a computer program for performing the method of any of claims 1-7.

Images